6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-26465

CVE-2025-26465: A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in...

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-26465

CVE-2025-26465:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis is based on the detailed technical description provided in the Qualys Security Advisory (https://www.openwall.com/lists/oss-security/2025/02/18/1) and corroborated by the OpenSSH 9.9p2 release notes. CVE-2025-26465 stems from an incorrect error handling logic in verify_host_key_callback when processing the return value of verify_host_key. Specifically, if sshkey_from_private (called within verify_host_key) fails due to memory exhaustion (returning SSH_ERR_ALLOC_FAIL / -2), verify_host_key_callback mistakenly treats this as a successful verification, bypassing the host key check. CVE-2025-26466 provides the means to achieve this memory exhaustion. It involves the ssh_packet_read_poll_seqnr (or similar packet reading function) processing incoming PINGs and ssh_packet_send2 (or a function it calls) buffering the corresponding PONGs in an unbounded list during key exchange. This unbounded buffering leads to memory exhaustion on the client, which is the prerequisite for exploiting CVE-2025-26465. The function names and file paths are inferred from standard OpenSSH codebase structure and the line numbers/code snippets provided in the advisory. Confidence is high due to the detailed nature of the advisory, even without direct commit diff access from commit diff access from commits.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.